fix: validates custom policy and resourceURL (#3255)

* fix: validates custom provided policies

Validates any customer provided json policy document for CloudFront\Signer.php to avoid any non allowed symbols.

* chore: add changelog entry

* fix: validate also resourceURL

* chore: normalize url path parts.

Author: yenfryherrerafeliz

src/CloudFront/Signer.php

@@ -84,6 +84,7 @@ public function getSignature($resource = null, $expires = null, $policy = null)
             self::validatePolicy($policy);
             $signatureHash['Policy'] = $this->encode($policy);
         } elseif ($resource && $expires) {
+            self::validateResourceUrl($resource);
             $expires = (int) $expires; // Handle epoch passed as string
             $policy = $this->createCannedPolicy($resource, $expires);
             $signatureHash['Expires'] = $expires;

src/CloudFront/UrlSigner.php

@@ -101,7 +101,7 @@ private function createResource($scheme, $url)
                 $parts = parse_url($url);
                 $pathParts = pathinfo($parts['path']);
                 $resource = ltrim(
-                    $pathParts['dirname'] . '/' . $pathParts['basename'],
+                    str_replace('\\', '/', $pathParts['dirname']) . '/' . $pathParts['basename'],
                     '/'
                 );
 

tests/CloudFront/SignerTest.php

@@ -188,6 +188,18 @@ public function testValidatesCustomPolicy(string $resourceUrl)
         $this->instance->getSignature(null, null, $policy);
     }
 
+    /**
+     * @dataProvider invalidResourceUrlProvider
+     */
+    public function testValidatesInvalidURLs(string $resourceUrl)
+    {
+        $this->expectException(\InvalidArgumentException::class);
+        $this->expectExceptionMessage('URL contains invalid characters: ", \\, or control characters');
+
+        $expires = time() + 3600;
+        $this->instance->getSignature($resourceUrl, $expires);
+    }
+
     public static function invalidResourceUrlProvider(): array
     {
         return [